QU
Vendor
Quarkus
50
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-12894 | QU quarkus-qute Quarkus | 8.8 | Aug 31 | Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine |
| CVE-2026-50559 | QU Quarkus Quarkus | 7.5 | Jun 19 | Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities |
| CVE-2026-39852 | QU Quarkus Quarkus | 8.2 | May 5 | Quarkus authorization bypass via semicolon path normalization inconsistency |
| CVE-2025-66560 | QU Quarkus Quarkus | 7.5 | Jan 7 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications |
| CVE-2024-12225 | QU Quarkus Quarkus | 9.1 | May 6 | A vulnerability was found in Quarkus in the quarkus-security-webauthn module |
| CVE-2023-6267 | QU Quarkus Quarkus | 9.8 | Jan 25 | A flaw was found in the json payload |
| CVE-2023-6394 | QU Quarkus Quarkus | 9.1 | Dec 9 | Quarkus: graphql operations over websockets bypass |
| CVE-2023-5720 | QU Quarkus Quarkus | 7.5 | Nov 15 | A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain |
| CVE-2023-1584 | QU Quarkus Quarkus | 7.5 | Oct 4 | A flaw was found in Quarkus |
| CVE-2023-4853 | QU Quarkus Quarkus | 8.1 | Sep 20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of… |
| CVE-2023-0481 | QU Quarkus Quarkus | 3.3 | Feb 24 | In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that… |
| CVE-2023-0044 | QU Quarkus Quarkus | 6.1 | Feb 23 | If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure |
| CVE-2022-4147 | QU Quarkus Quarkus | 7.5 | Dec 6 | Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed |
| CVE-2022-4116 | QU Quarkus Quarkus | 9.8 | Nov 22 | A vulnerability was found in quarkus |
| CVE-2022-42004 | QU Quarkus Quarkus | 7.5 | Oct 2 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested… |
| CVE-2022-42003 | QU Quarkus Quarkus | 7.5 | Oct 2 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep… |
| CVE-2022-2466 | QU Quarkus Quarkus | 9.8 | Aug 31 | It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior |
| CVE-2022-0981 | QU Quarkus Quarkus | 8.8 | Mar 23 | A flaw was found in Quarkus |
| CVE-2022-21724 | QU Quarkus Quarkus | 9.8 | Feb 2 | pgjdbc is the offical PostgreSQL JDBC Driver |
| CVE-2022-21363 | QU Quarkus Quarkus | 6.6 | Jan 19 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J) |
| CVE-2021-43797 | QU Quarkus Quarkus | 6.5 | Dec 9 | HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling |
| CVE-2021-2471 | QU Quarkus Quarkus | 5.9 | Oct 20 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J) |
| CVE-2021-37137 | QU Quarkus Quarkus | 7.5 | Oct 19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage |
| CVE-2021-37136 | QU Quarkus Quarkus | 7.5 | Oct 19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression) |
| CVE-2021-38153 | QU Quarkus Quarkus | 5.9 | Sep 22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more… |
| CVE-2021-37714 | QU Quarkus Quarkus | 7.5 | Aug 18 | Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions |
| CVE-2021-3642 | QU Quarkus Quarkus | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… |
| CVE-2021-28170 | QU Quarkus Quarkus | 5.3 | May 26 | In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid |
| CVE-2020-25724 | QU Quarkus Quarkus | 4.3 | May 26 | A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided |
| CVE-2021-26291 | QU Quarkus Quarkus | 9.1 | Apr 23 | Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a… |
| CVE-2021-29427 | QU Quarkus Quarkus | 7.2 | Apr 13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning |
| CVE-2021-29428 | QU Quarkus Quarkus | 7.8 | Apr 13 | Local privilege escalation through system temporary directory |
| CVE-2021-29429 | QU Quarkus Quarkus | 5.5 | Apr 12 | Information disclosure through temporary directory permissions |
| CVE-2021-21409 | QU Quarkus Quarkus | 5.9 | Mar 30 | Possible request smuggling in HTTP/2 due missing validation of content-length |
| CVE-2021-20289 | QU Quarkus Quarkus | 5.3 | Mar 26 | A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final |
| CVE-2021-21295 | QU Quarkus Quarkus | 5.9 | Mar 9 | Possible request smuggling in HTTP/2 due missing validation |
| CVE-2021-20328 | QU Quarkus Quarkus | 6.8 | Feb 25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate |
| CVE-2020-28491 | QU Quarkus Quarkus | 7.5 | Feb 18 | This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1 |
| CVE-2021-21290 | QU Quarkus Quarkus | 5.5 | Feb 8 | Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files |
| CVE-2020-8908 | QU Quarkus Quarkus | 3.3 | Dec 10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory… |
| CVE-2020-25649 | QU Quarkus Quarkus | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly |
| CVE-2020-13956 | QU Quarkus Quarkus | 5.3 | Dec 2 | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick… |
| CVE-2020-25638 | QU Quarkus Quarkus | 7.4 | Dec 2 | A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final |
| CVE-2020-25633 | QU Quarkus Quarkus | 5.3 | Sep 18 | A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final |
| CVE-2019-14900 | QU Quarkus Quarkus | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 |
| CVE-2020-13692 | QU Quarkus Quarkus | 7.7 | Jun 4 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE |
| CVE-2020-1714 | QU Quarkus Quarkus | 8.8 | May 13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks |
| CVE-2020-10693 | QU Quarkus Quarkus | 5.3 | May 6 | A flaw was found in Hibernate Validator version 6.1.2.Final |
| CVE-2020-1728 | QU Quarkus Quarkus | 5.4 | Apr 6 | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in… |
| CVE-2017-18640 | QU Quarkus Quarkus | 7.5 | Dec 12 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564 |